I'd assume that most attacks are coming not from attackers directly, but from some sort of hacked devices in some other country, either webcam with root access

I'd assume that most attacks are coming not from attackers directly, but from some sort of hacked devices in some other country, either webcam with root access or similar, maybe even proxy servers. Would be interesting to match malicious IP addresses with ones indexed by shodan to test this theory.